Verify Crisp website ownership before connecting

Crisp is a managed (Model B) connector: Probo holds one plugin token
server-side and each connection carries only a Website ID. Nothing
stops one organization from entering another organization's Website
ID, so prove control of the website before creating the connection.

Probo derives a per-(organization, website) verification code as an
HMAC over the token secret and exposes it through a new
crispVerificationCode query. The customer pastes it into the Probo
plugin's per-website settings; at connect time the resolver reads the
setting back through the managed plugin token and requires a
constant-time match before any row is written. The managed key and
plugin ID come from bootstrap, so the connector stays hidden until the
deployment configures them.

The settings fetch is injected so the create-time gate's branch wiring
is unit-tested (mismatch and not-subscribed reject, internal errors
stay generic, a matching code passes), and the managed-versus-client
key resolution is covered too.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/apply.go

@@ -72,6 +72,36 @@ func (r *Registry) ApplyOAuth2Defaults(p string, redirectURI string, c *connecto
 	return nil
 }
 
+// ApplyManagedAPIKey injects the Probo-held API key into a freshly loaded
+// ManagedAPIKey connector's connection, so the credential is resolved at
+// use time — surviving key rotation and never persisted on the connection
+// row (only the extra settings, e.g. a Crisp Website ID, are stored). It is
+// a no-op for every non-managed provider, so callers may invoke it
+// unconditionally before building a connection's HTTP client. It errors
+// when a managed provider's key is unconfigured (the connector was
+// deactivated after the connection was created) or when the connection is
+// not an API-key connection.
+func (r *Registry) ApplyManagedAPIKey(dbConnector *coredata.Connector) error {
+	reg, ok := r.Get(dbConnector.Provider)
+	if !ok || !reg.ManagedAPIKey {
+		return nil
+	}
+
+	apiKeyConn, ok := dbConnector.Connection.(*connector.APIKeyConnection)
+	if !ok {
+		return fmt.Errorf("cannot apply managed api key for provider %q: connection is not an api-key connection", dbConnector.Provider)
+	}
+
+	key, ok := r.ManagedAPIKey(dbConnector.Provider)
+	if !ok {
+		return fmt.Errorf("cannot apply managed api key for provider %q: not configured", dbConnector.Provider)
+	}
+
+	apiKeyConn.APIKey = key
+
+	return nil
+}
+
 // ProbeURL returns the registered probe URL for provider p, or the
 // empty string if no probe URL is configured.
 func (r *Registry) ProbeURL(p string) string {